CVE-2026-118378 Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted tablename to the describetable tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument...

CVE-2026-118378

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted tablename to the describetable tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument...

PT-2026-128238

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1...

PT-2026-129214

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although...

PT-2026-127744

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table name to the describe table tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argumen...

PT-2026-127846

The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an...

PT-2026-127889

The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort order' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-112197: Tactis NoviGest Desktop App: Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service

Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The...

Dell PowerProtect Data Domain Management Center SQL injection vulnerability

SQL injection vulnerabilities exist in Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20. These vulnerabilities stem from improper handling of special elements within SQL commands, makin...

PT-2026-129212

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 8.1.0 Description An unauthenticated installer endpoint install/checkConfiguration.php fails to escape request parameters, such as webSiteRootURL, when interpolating them into single-quoted PHP string literals to creat...

CVE-2026-14571: Futurum Software Futurum Software User Authentication Module: A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of adequate validation…

A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of adequate validation and sanitisation of user-provided inputs in queries to the private area’s database, as well as by an incorrect WAF configuration. This weakness allows the protection mechanisms t...

CVE-2026-86386: Dell PowerProtect Data Domain Management Center: Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions…

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...

CVE-2026-54455: OpenCATS: OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, activity DataGrid date filtering in home:CallsDataGrid and activity:ActivityDataGrid uses request-controlled period, startDate and endDate parameters without...

PT-2026-127900

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...

WordPress JS Archive List 6.1.5 SQL Injection

WordPress JS Archive List plugin version 6.1.5 and earlier contains an unauthenticated SQL injection vulnerability in the cats parameter of its REST API archive endpoint. The included proof of concept demonstrates identification with ghauri. https://packetstorm.news/download/238016...

PT-2026-127849

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks...

WordPress BuddyPress SQL injection vulnerability

WordPress BuddyPress versions 14.5.2 and earlier contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, potentially leading to SQL injection attacks...

CVE-2026-111027: Unknown Welcart e-Commerce: The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it…

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks...

PT-2026-128255

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Advanced Ads GmbH Advanced Ads – Tracking advanced-ads-tracking allows Blind SQL Injection.This issue affects Advanced Ads – Tracking: from n/a before 4.0.0...

CVE-2026-115603: Advanced Ads GmbH Advanced Ads – Tracking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Advanced Ads GmbH…

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Advanced Ads GmbH Advanced Ads – Tracking advanced-ads-tracking allows Blind SQL Injection.This issue affects Advanced Ads – Tracking: from n/a before 4.0.0...